Cyber security means protecting computers, phones, networks and data from attack, damage and theft. Papers ask three things again and again: the kinds of harmful software (malware), encryption (turning data into secret code), and safety habits for your phone and the internet. This page explains all three in simple words. It teaches you to recognise threats and protect yourself.
49
Past questions on this page
Punjab Police SI & Constable
2
Types of encryption
Symmetric and asymmetric
64
Bits in one DES block
Data Encryption Standard
1930
Cyber crime helpline, India
Report online fraud quickly
What cyber security protects
The branches of cyber security and the risks to information.
| Branch | What it protects |
|---|---|
| Information security | The integrity and privacy of data, both in storage and in transit (moving) |
| Network security | The computer network itself, from intruders and harmful traffic |
| Application security | Software and apps, so they have no weak spots |
| Operational security | The processes and decisions for handling and protecting data: who gets which permission, where data is kept |
| Cloud / mobile security | Data kept with a cloud company; phones and tablets |
| End-user education | Teaching people safe habits, because one careless click can let an attack in |
REMEMBER
Information = the data itself. Operational = the rules and decisions about the data.
Risk
Interception
Someone secretly reads data while it travels.
Risk
Unauthorised access
A person without permission gets into a system or file.
Risk
Data destruction
Data is deleted or damaged and cannot be used.
Not a risk
Authorised disclosure
Giving data to someone who has the right to it. This is allowed.
Watch the words authorised and unauthorised. One letter group changes the answer.
KEY TERM
Vulnerability
A vulnerability is a weak spot that an attacker could use. Two weak spots in networks that are commonly named: inadequate border protection (a weak "boundary" around the network, such as a missing or badly set firewall), and remote access servers with weak access controls (easy passwords, no extra checks). Security teams fix these first.
Weak spot→Found and fixed→Safer network
QUICK CHECK
Which of the following categories of cyber security denotes the protection of the integrity and privacy of data, both in storage and in transit?
Tap an option to answer
Answer: A — Information security
Punjab Police SI, 2023. Information security guards the data itself, wherever it is. Network security is the trap: it guards the network, not the data's privacy.
QUICK CHECK
With regard to information risks in cyber security practice, which of the following is NOT included?
Tap an option to answer
Answer: C — Authorised disclosure
Punjab Police SI, 2023. Authorised disclosure is a lawful, permitted release of data, so it is not a risk. The other three harm data.
Malware: the families of harmful software
Virus, worm, Trojan, spyware, adware, ransomware: know each by what it does.
KEY TERM
Malware
Malware = malicious software. It is the umbrella word for any program made to damage devices, steal data or cause trouble for the user. Virus, worm, Trojan and spyware are all kinds of malware.
Malware (umbrella)→Virus, worm, Trojan …
| Type | How to recognise it |
|---|---|
| Virus | Attaches itself to a file. It spreads when that file is opened or run. |
| Worm | Copies itself across a network on its own. It needs no host file. |
| Trojan horse | Hides inside something that looks useful, such as a game or spreadsheet, and then harms data. |
| Spyware | Secretly gathers information about a person or organisation without their knowledge. |
| Adware | Pushes unwanted advertisements on your screen. |
| Ransomware | Locks or encrypts your files and demands payment (ransom) to unlock them. |
Virus type
Stealth virus
Hides its presence from the system and from antivirus checks.
Virus type
Polymorphic virus
Changes its own code each time it spreads, so it is harder to spot.
Virus type
Multipartite virus
Attacks in more than one way, for example the boot sector and files.
Virus type
Boot sector virus
Infects the part of a disk that starts the computer.
Stealth, polymorphic and multipartite are all recognised types of virus.
QUICK CHECK
______ is software that is developed with the intention of damaging hardware devices, stealing data or creating any kind of trouble for the user.
Tap an option to answer
Answer: B — Malware
Punjab Police SI, 2023. "Any kind of trouble" points to the umbrella word, malware. Virus, worm and Trojan are each just one kind.
QUICK CHECK
What is a code generally hidden in games or spreadsheets and causes harm to the data?
Tap an option to answer
Answer: D — Trojan Horse
Punjab Police Constable, 2021. A Trojan hides inside something that looks useful. A worm needs no disguise, and a disk cleaner is a genuine tool.
QUICK CHECK
______ is a type of malware that spies on a person or an organisation by gathering information about them without the knowledge of the user.
Tap an option to answer
Answer: C — Spyware
Punjab Police SI, 2023. Spyware is named for spying. Adware is the near miss: its aim is to show ads, not to collect your secrets.
Common cyber attacks and how they are stopped
Phishing, social engineering, ransomware and denial-of-service.
Attack
Phishing
Fake emails that look like they come from a bank or a trusted company. They try to get your password or OTP.
Attack
Social engineering
The wide family of tricking people into giving away secrets. Phishing is one kind.
Attack
Ransomware
Locks your files and demands money.
Attack
DoS / DDoS
Denial of Service. A server is flooded with so much traffic that real users cannot reach it. Distributed = from many computers at once.
- Spot a phishing message: it creates panic ("your account will close today"), has a strange sender address or link, and asks for a password, OTP or card number. A real bank never asks for your OTP.
- The same trick by phone call is often called vishing, and by SMS smishing.
HOW A DOS ATTACK IS RESISTED
- Router filters block suspicious traffic at the edge of the network.
- Quota systems in the operating system limit how much disk or memory one user can fill.
- A firewall checks traffic coming in and going out.
NOT AN ATTACK
- Firmware is the permanent program inside a chip (like BIOS). It can be a target, but it is not an attack.
- Spam is junk mail, not malware.
- A disk cleaner removes junk files; it is a helpful tool.
COMMON TRAPS
- Ransomware, phishing and denial-of-service are common attacks. Firmware is the odd one out.
- If a question says fraudulent emails, choose phishing, not the wider "social engineering".
QUICK CHECK
Which of the following refers to the practice of sending fraudulent emails that resemble emails sent by reputable sources?
Tap an option to answer
Answer: D — Phishing
Punjab Police SI, 2023. Phishing is the email trick by name. Social engineering is the wider family, so it is too broad here.
QUICK CHECK
How you can protect your system for DOS/DDOS attacks? I. Implement router filters. This will lessen your exposure to certain DOS attacks. II. Enable quota systems on your operating system if they are available.
Tap an option to answer
Answer: C — Both I and II
Punjab Police SI, 2021. A DoS attack tries to use up a resource. Router filters stop part of the flood, and quotas stop one user filling the system.
Encryption: turning data into secret code
Plaintext, ciphertext, keys, and why encryption matters.
HOW ENCRYPTION WORKS
- PlaintextThe normal, readable message.
- keyEncryptionAn algorithm (set of steps) and a key scramble it.
- CiphertextThe scrambled, unreadable data.
- keyDecryptionThe right key turns it back into plaintext.
KEY TERM
Encryption is a security method
Encryption is a security method. It encodes information so that only an authorised user (who has the key) can read it. If a thief steals encrypted data, he sees only ciphertext.
Key holder→can read→everyone else sees code
WHAT ENCRYPTION GIVES
- Data privacy (confidentiality)
- Data integrity: tampering shows up
- Protection from unauthorised access
- Overall data security
WHAT ENCRYPTION DOES NOT DO
- It does not cause or allow a data breach; it works against one.
- It does not let attackers modify data.
- It does not make data easier to reach or upload faster.
- It is not a backup.
Proving who you are (authentication) is a different job
Something you are: a fingerprint scanner, like those used for office attendance
Sanskritibharti1398, Wikimedia Commons · CC BY-SA 4.0
CAPTCHA: twisted text that a person can read but a bot finds hard
Damian Yerrick, Wikimedia Commons · Public domain
QUICK CHECK
In cryptography, the encrypted data is referred to as ____________.
Tap an option to answer
Answer: D — ciphertext
Punjab Police SI, 2023. Ciphertext is the output data. Encryption and decryption are processes, and plaintext is the data before encryption.
QUICK CHECK
Which of the following is a common method of data encryption?
Tap an option to answer
Answer: C — AES encryption
Punjab Police SI, 2023. AES actually scrambles the data. The other three only check who you are.
Symmetric and asymmetric encryption
One key or two? The most asked idea on this page.
REMEMBER
Symmetric = Same key. Asymmetric = A pair of keys (public to lock, private to unlock).
ASYMMETRIC ENCRYPTION STEP BY STEP
- Receiver shares a public keyAnyone may have it. It is not secret.
- Sender encrypts with itPlaintext + public key + encryption algorithm → ciphertext.
- privateReceiver decryptsOnly the matching private key and the decryption algorithm can open it.
| Name | Full form | Type and key fact |
|---|---|---|
| DES | Data Encryption Standard | Symmetric. US standard from 1977. Works on 64-bit blocks; effective key 56 bits. |
| 3DES | Triple DES | Symmetric. DES applied three times. |
| AES | Advanced Encryption Standard | Symmetric. Adopted in 2001 to replace DES. 128-bit blocks; keys of 128, 192 or 256 bits. |
| Twofish | (a name, not short form) | Symmetric block cipher. |
| RSA | Rivest–Shamir–Adleman | Asymmetric. Named after its three inventors (1977). |
| ECC | Elliptic Curve Cryptography | Asymmetric. |
| DSS | Digital Signature Standard | Asymmetric (public-key signatures). |
| PKI | Public Key Infrastructure | The whole system of public/private keys and digital certificates. Asymmetric. |
- Encryption methods differ by: the type of key (symmetric or asymmetric), the key length (56-bit DES vs 128/256-bit AES) and the block size. The number of users does not change the method.
- Symmetric rules: the same algorithm and the same key encrypt and decrypt; the key must be kept secret; without the key it should be impossible, or at least impractical, to read the message.
- A matched pair of keys (one with the sender, one with the receiver) belongs to asymmetric encryption, not symmetric.
- Why public keys make key management easier: public keys need no secrecy, so no trusted third party is needed for each exchange, and each user can keep a copy of the public file.
COMMON TRAPS
- Public-key cryptography is asymmetric, never "symmetric".
- AES is symmetric. It is the usual odd one out in a list of asymmetric methods. RSA is asymmetric, the odd one out in a symmetric list.
- DNS (Domain Name System / Server) turns website names into IP addresses. It is not an encryption method at all.
- The two asymmetric keys are public key and private key, not "personal key" or "admin key".
QUICK CHECK
Which of the following is/are the examples of asymmetric encryption methods? (i) Data Encryption Standard (DES) (ii) Advanced Encryption Standard (AES) (iii) Rivest – Shamir – Adleman (RSA) (iv) Public Key Infrastructure (PKI)
Tap an option to answer
Answer: D — Only (iii) and (iv)
Punjab Police SI, 2022. DES and AES use one shared key, so they are symmetric. RSA and PKI use a public/private key pair.
QUICK CHECK
Which of the following is NOT correct regarding a symmetric encryption system?
Tap an option to answer
Answer: C — The sender and the receiver must each have one of a matched pair of keys.
Punjab Police SI, 2021. A matched pair of keys describes asymmetric encryption. Symmetric encryption shares one secret key.
QUICK CHECK
DES is a low-level encryption block cipher algorithm that takes plaintext in blocks of _______ bits to convert the plaintext into ciphertext.
Tap an option to answer
Answer: A — 64
Punjab Police SI, 2023. DES works on 64-bit blocks. 128-bit blocks belong to AES, a common trap.
Staying safe on your phone and online
Simple habits that block most attacks.
DO
- Lock your phone with a PIN or password. Treat passwords as keys.
- Use strong, different passwords for each account.
- Install antivirus and keep apps updated.
- Take a regular backup of your data.
- Turn Wi-Fi and Bluetooth off when not in use.
- Use a VPN (Virtual Private Network) on public networks.
DON'T
- Don't connect to open or free Wi-Fi for banking or logins.
- Don't click unknown links or attachments.
- Don't download unknown files or apps from outside the official store.
- Don't post personal information online (address, date of birth, travel plans).
- Don't visit suspicious websites or apps.
- Never share an OTP with anyone.
KEY TERM
VPN
Virtual Private Network. It builds an encrypted tunnel between your device and the network. Anyone watching a public Wi-Fi sees only scrambled data.
Your phone→Encrypted tunnel→Internet
| Name | Mobile security tool? |
|---|---|
| Norton, Bitdefender, Kaspersky | Yes: antivirus makers with phone apps |
| Lookout, zIPS, WISeID | Yes: mobile protection tools |
| Compass | No: a direction-finding app |
| Canva | No: a graphic-design tool |
QUICK CHECK
State whether the following statements are true or false for cyber safety tips. (i) Use anti-virus software. (ii) Use insecure Wi-Fi networks in public places. (iii) Use strong passwords.
Tap an option to answer
Answer: D — (i) True, (ii) False, (iii) True
Punjab Police SI, 2023. Antivirus and strong passwords are good advice. Insecure public Wi-Fi is a risk, so statement (ii) is false.
QUICK CHECK
Which of the following is NOT an antivirus solution for smartphones?
Tap an option to answer
Answer: A — Compass
Punjab Police SI, 2023. Norton, Bitdefender and Kaspersky all make mobile antivirus apps. Compass is a direction-finding app.
QUICK CHECK
Which of the following is NOT a mobile protection tool?
Tap an option to answer
Answer: B — Canva
Punjab Police SI, 2023. zIPS, WISeID and Lookout are mobile security products. Canva is for designing posters and slides.
Quick revision
Full forms, traps and one-line facts.
FLASHCARDS
Full forms: tap to check
- DES
- Data Encryption Standard
- AES
- Advanced Encryption Standard
- RSA
- Rivest–Shamir–Adleman
- ECC
- Elliptic Curve Cryptography
- DSS
- Digital Signature Standard
- PKI
- Public Key Infrastructure
- DSCI
- Data Security Council of India
- DoS / DDoS
- Denial of Service / Distributed Denial of Service
- VPN
- Virtual Private Network
- OTP
- One Time Password
- 2FA
- Two-Factor Authentication
- CAPTCHA
- Completely Automated Public Turing test to tell Computers and Humans Apart
COMMON TRAPS
- Encrypted data = ciphertext. Readable data = plaintext.
- Symmetric = one key, asymmetric = two keys.
- Malware is the umbrella word; virus, worm and Trojan sit under it.
- A data breach is what encryption prevents, not something it provides.
- Using open public Wi-Fi is a risk, never a safety tip.
Also asked onceTap to open
- DSCI = Data Security Council of India, an industry body set up by NASSCOM to promote data protection and cyber security practices.
- Active vs passive information gathering: network test tools like ping, arping and bing (here a small network tool, not the Bing search engine) send signals directly to a computer, so they count as active. Looking at public maps such as Google Earth touches nothing, so it is passive, not active.
- AES is the encryption method that uses only one secret key for both encryption and decryption (RSA and PKI use two).
- Why encryption matters: to protect sensitive information from unauthorised access. It does not speed up uploads or replace backups.
- In India, CERT-In is the national agency that responds to cyber security incidents.
CHECK YOURSELF
Your friend gets an SMS: "Your bank account is blocked. Share the OTP to unlock it." Name this attack and write two things your friend should do.
Show answer
It is phishing (by SMS, also called smishing), a kind of social engineering. Never share the OTP or click the link; call the bank on its official number, and report fraud on 1930 if money was lost.